-
Cybersecurity researchers have uncovered a hardware backdoor within a particular model of MIFARE Classic contactless cards that could allow authentication with an unknown key and open hotel rooms and office doors. The attacks have been demonstrated against FM11RF08S, a new variant of MIFARE Classic that was released by Shanghai Fudan Microelectronics in 2020. “The FM11RF08S backdoor enables any
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
SolarWinds has issued patches to address a new security flaw in its Web Help Desk (WHD) software that could allow remote unauthenticated users to gain unauthorized access to susceptible instances. “The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing [a] remote unauthenticated user to access internal functionality and modify data,” the company
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Details have emerged about a China-nexus threat group’s exploitation of a recently disclosed, now-patched security flaw in Cisco switches as a zero-day to seize control of the appliance and evade detection. The activity, attributed to Velvet Ant, was observed early this year and involved the weaponization of CVE-2024-20399 (CVSS score: 6.0) to deliver bespoke malware and gain extensive control
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
As many as 15,000 applications using Amazon Web Services’ (AWS) Application Load Balancer (ALB) for authentication are potentially susceptible to a configuration-based issue that could expose them to sidestep access controls and compromise applications. That’s according to findings from Israeli cybersecurity company Miggo, which dubbed the problem ALBeast. “This vulnerability allows attackers to
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
INE Security, a global cybersecurity training and certification provider, recently launched initiatives with several higher education institutions in an ongoing campaign to invest in the education of aspiring cybersecurity professionals.
“There is a critical skills gap in the industry, which has enormous implications for businesses and individuals alike,” said Dara Warn, INE Security’s CEO. “We are working to partner with higher education institutions to close that gap, rewrite the book on how to prepare cybersecurity students, and ultimately reinforce the entire industry’s strength and security.”
According to the team, in a world where digital threats transcend borders, the need for robust cybersecurity education has never been more critical. Universities around the globe are stepping up, recognizing that their role in preparing the next generation of cybersecurity experts is crucial not only for national security but also for maintaining global competitiveness. As cyber threats become more sophisticated, educational institutions are compelled to provide their students with the skills necessary to navigate and mitigate these risks effectively.
One of the most pressing reasons for advanced cybersecurity training is the sheer scale and global nature of cyber threats. According to the 2020 Cost of a Data Breach Report by IBM, the average total cost of a data breach globally reached $3.86 million, highlighting the severe economic impact of these incidents. This global threat landscape requires a workforce that is not only technically proficient but also equipped with a comprehensive understanding of international cybersecurity challenges.
INE Security + Columbus State University
Columbus State University (CSU) is a public university located in the southeastern United States, serving approximately 7,000 students annually. To address the growing demand for skilled cybersecurity professionals in Georgia, CSU launched the NEXUS program in 2017, driven by the state’s identified shortage of 15,000-30,000 IT and cybersecurity professionals. The challenge was that CSU’s cybersecurity education lacked hands-on labs and certification opportunities, making it difficult for students to gain practical skills and accredited certifications essential for the cybersecurity workforce.
In 2019, CSU partnered with INE Security to integrate the Junior Penetration Tester (eJPT) certification into its curriculum. The eJPT learning path’s hands-on nature, robust application, and immediate feedback were key in addressing the practical training gap. Cybersecurity lecturers at CSU led the integration of the eJPT certification. Since then, 122 students have registered and completed the certification, following a progressive training model starting with IT Fundamentals and CompTIA certifications, followed by eJPT, and culminating in the SEC+ certification. The eJPT certification ensures foundational skills for advanced roles, with a 90% first-attempt pass rate and immediate feedback for those retaking the exam.
INE Security + FOUR18 Intelligence
FOUR18 Intelligence works with students to deliver live-fire training, and partnered with INE Security to enhance hands-on, real-world cyber defense education. The collaboration aims to make high-quality cybersecurity training accessible and impactful for learners at every stage of their career, anywhere in the world. Part of the strategy centers around FOUR18’s DEF3NSE system, which is the first of its kind to offer live-fire cyber threat learning and micro-internships at scale. The partnership is designed to provide students a truly immersive learning experience that prepares them for real-world security risks through practical hands-on engagement, a goal achieved through the joining of INE Security and FOUR18 Intelligence.
INE Security + Virtually Testing Foundation
Virtually Testing Foundation (VTF) is a California-based 501(c)3 e-learning non-profit organization that started with a mission to educate and help people transition into the field of cybersecurity. INE Security partnered with VTF as a technical training resource, giving the organization’s interns access to premium training, hands-on labs, on-demand videos, immersive learning tactics, and discounted access to highly sought-after industry certifications. The partnership opportunity enables VTF interns to access top-tier training materials at no cost, representing a crucial stride in equipping individuals with cybersecurity skills to close critical skills gaps.
Career Prospects
The career prospects in the cybersecurity field are highly promising. The Bureau of Labor Statistics projects a 31% growth in employment for information security analysts from 2019 to 2029, significantly faster than the average for all occupations. This demand reflects the critical need for cybersecurity professionals who are well-versed in handling both national and international challenges.
Furthermore, the integration of advanced technologies like artificial intelligence and machine learning in combating cybercrime highlights the evolving nature of the field and the continuous learning opportunities it presents. Universities that collaborate with cybersecurity firms to incorporate these technologies into their training programs not only enhance the learning experience but also ensure that their students are prepared for the future demands of the cybersecurity landscape.
Higher education Impact on The Future
Higher education institutions and organizations that invest in comprehensive cybersecurity training, especially through partnerships with experienced cybersecurity training partners, are making a significant contribution to the global economy. By equipping students with the necessary skills to face and address international cyber challenges effectively, these institutions are ensuring that their graduates are not only competitive but also ready to lead in the global arena. These efforts not only protect the institutions’ data and reputations but also prepare their students for a world where cybersecurity expertise is revered and essential.
About INE Security:
INE Security is the premier provider of online networking and cybersecurity training and certification. Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers. INE Security’s suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.
Contact
Director of Global Strategic Communications and Events
Kathryn Brown
INE Security
kbrown@ine.comThe post INE Security Launches Initiatives to Invest in the Education of Aspiring Cybersecurity Professionals appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The former lawmaker is looking to draw on a decade of national security policy work in the new position.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybersecurity researchers at Aqua Nautilus have uncovered a new malware named PG_MEM that targets PostgreSQL databases.
This sophisticated malware employs brute force attacks to gain access, hides within legitimate PostgreSQL processes, and ultimately steals data while mining cryptocurrency.
This article delves into the intricate workings of PG_MEM, its attack flow, and its implications for database security.
Understanding PostgreSQL and Brute Force Attacks
PostgreSQL, commonly called Postgres, is a robust open-source relational database management system known for its flexibility and reliability.
However, its popularity also makes it a target for cybercriminals, as per a report by Aqua Nautilus. Brute force attacks on PostgreSQL involve repeatedly attempting to guess database credentials until access is gained, exploiting weak passwords.
Once inside, attackers can execute arbitrary shell commands using the COPY … FROM PROGRAM SQL command, enabling them to perform malicious activities such as data theft or deploying malware.
Screenshot from Wireshark, illustrating failed brute force attempt against Postgres The Attack Flow of PG_MEM
Stage 1: Brute Force Attack
The initial stage of the PG_MEM attack involves a brute-force attempt to gain access to the PostgreSQL database.
This involves numerous login attempts until the attacker successfully guesses the username and password.
Once access is gained, the attacker can execute commands and manipulate the database environment. Failed Brute Force Attempt
Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trialStage 2: Gaining Persistence
After gaining access, the attacker creates a superuser role in the database, allowing them to maintain control and evade detection.
This involves executing SQL commands to manipulate user roles and privileges, ensuring the attacker retains access while restricting others. Creating a Superuser Backdoor
The threat actor’s command to create a new superuser Stage 3: System Discovery and Payload Delivery
The attacker gathers system information and delivers malicious payloads by exploiting PostgreSQL’s features.
Two files, including the PG_Core malware, were downloaded from the attacker’s remote server and executed to mine cryptocurrency.
The malware is cleverly disguised and executed using encoded commands to avoid detection.
Delivery of PG_Core malware The Role of PG_MEM in Cryptocurrency Mining
PG_MEM acts as a dropper for a cryptocurrency miner known as XMRIG. Once deployed, it optimizes the mining operation by leveraging the system’s resources.
The attacker establishes persistence by creating cron jobs that ensure the continued execution of PG_MEM, thereby maintaining control over the compromised server. Cryptocurrency Mining Configuration
Mining Cryptocurrency data Exposed PostgreSQL Servers: A Growing Concern
The discovery of PG_MEM highlights the vulnerability of exposed PostgreSQL servers. A search on Shodan, a search engine for Internet-connected devices, revealed over 800,000 publicly accessible PostgreSQL databases.
This underscores the urgent need for robust security measures to protect against such attacks. Exposed PostgreSQL Servers on Shodan
The PG_MEM attack aligns with several techniques outlined in the MITRE ATT&CK framework.
These include exploiting public-facing applications, command and scripting interpreter execution, account manipulation, and resource hijacking. Understanding these techniques can help develop effective defense strategies.
Detection and Remediation
Organizations must adopt a defense-in-depth approach to safeguard against PG_MEM and similar threats.
This includes implementing strong password policies, regular security audits, and using runtime detection and response tools like Aqua’s Runtime Protection.
Such tools can detect suspicious behavior in real-time, providing crucial insights into potential vulnerabilities.
The PG_MEM malware, combining data theft with cryptocurrency mining, represents a sophisticated threat to PostgreSQL databases.
As cyber threats continue to evolve, organizations must enhance their security measures to ensure that their databases remain protected against malicious activities.
By understanding the tactics employed by attackers and implementing robust defenses, businesses can safeguard their critical data and maintain operational integrity.
Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free TrialThe post PG_MEM – A Malware Hide in Postgres Processes to Steal Data appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
What is Continuous Attack Surface Penetration Testing or CASPT? Continuous Penetration Testing or Continuous Attack Surface Penetration Testing (CASPT) is an advanced security practice that involves the continuous, automated, and ongoing penetration testing services of an organization’s digital assets to identify and mitigate security vulnerabilities. CASPT is designed for enterprises with an
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Recent attacks exploit the Log4j vulnerability (Log4Shell) by sending obfuscated LDAP requests to trigger malicious script execution, which establishes persistence, gathers system information, and exfiltrates data.
To maintain control, multiple backdoors and encrypted communication channels are established, while the attack’s persistence and ability to evade detection highlight the ongoing threat posed by the Log4j vulnerability.
Log4Shell, a critical vulnerability in the Apache Log4j library, was discovered in November 2021, with a CVSS score of 10, allowed attackers to execute arbitrary code remotely.
Request details Due to Log4j’s widespread use, it became a prime target for exploitation. Various threat actors, including nation-state groups and cybercriminals, quickly capitalized on this vulnerability.
Groups like APT41 and Conti incorporated Log4Shell exploits into their operations, demonstrating its significant impact on global cybersecurity.
Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trialOn July 30, 2024, a Confluence honeypot detected a Log4Shell exploitation attempt from a known Tor exit node, 185.220.101 [34], marking the beginning of a new, opportunistic campaign.
Upon further investigation, it was revealed that the attackers were leveraging the Log4Shell vulnerability to deploy XMRig, a cryptocurrency mining software, onto compromised systems, which highlights the ongoing threat posed by opportunistic threat actors who exploit vulnerabilities to carry out malicious activities.
Attack flow An attacker exploited a Log4j vulnerability using a cleverly obfuscated payload containing an LDAP URL, which triggered the vulnerable Java application to retrieve and execute a malicious Java class from a remote server.
The class downloaded a secondary script (“lte”) from another server and then executed it with root privileges. While its purpose is currently unknown, its ability to run arbitrary commands suggests potential for further malicious activity.
The malicious Java class downloads an obfuscated Bash script from a remote server, which performs system reconnaissance, downloads and configures a cryptocurrency miner, establishes persistence using systemd or cron jobs, and sets up reverse shells for remote control.
malicious script It gathers comprehensive system information, including CPU details, OS version, user data, network connections, group memberships, running processes, and system uptime.
This data is then transmitted to a remote server via an HTTP POST request.
To evade detection, the script self-destructs and clears its tracks by overwriting the bash history file and erasing the current shell’s command history.
An investigation by DataDog into potential Log4Shell exploitation revealed several indicators of compromise (IOCs).
A suspicious IP address, 185.220.101.34, along with domain names superr.buzz, cmpnst.info, nfdo.shop, and rirosh.shop, were identified.
Additionally, suspicious file paths were found on the system, including /tmp/lte, potentially used for temporary storage, and potential attempts to execute commands through /bin/rcd, /bin/componist, and /bin/nfdo, which suggest a possible attempt to exploit the Log4Shell vulnerability to gain unauthorized access to the system.
Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial
The post Log4j Vulnerability Exploited Again To Deploy Crypto-Mining Malware appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
CYBERSECURITY / DEFENSE / INTELLIGENCE
